基于.NET 8的HttpClient：如何捕获请求IP并防范DNS劫持风险？

问题1：如何确保DNS解析与HttpClient请求使用同一IP？ #

默认情况下无法保证两次独立DNS查询（手动Dns.GetHostEntry和HttpClient内部查询）的一致性——DNS缓存过期、DNS服务器返回变更、攻击者的缓存劫持都可能导致IP不一致。

可行的解决思路是跳过HttpClient自动DNS解析，直接使用你预先验证过的IP发起请求，同时处理TLS-SNI的要求：

1. 先调用Dns.GetHostEntry获取目标域名的IP列表，验证这些IP是否符合安全规则（你可以自己实现IP范围验证，或使用NuGet包IPAddressRange简化操作）
2. 选择一个通过验证的IP，构造连接端点
3. 通过SocketsHttpHandler的ConnectCallback自定义连接逻辑，连接到指定IP，同时在TLS握手时传入原主机名以满足SNI要求

示例代码：

var targetUrl = new Uri("https://example.com/api");
var allowedIpRanges = new List<IPAddressRange> { /* 你的安全IP范围 */ };

// 1. 解析并验证IP
var hostEntry = await Dns.GetHostEntryAsync(targetUrl.Host);
var validIp = hostEntry.AddressList.First(ip => allowedIpRanges.Any(range => range.Contains(ip)));
if (validIp == null)
{
    throw new InvalidOperationException("目标IP不在安全范围内");
}

// 2. 配置HttpClient使用指定IP
var handler = new SocketsHttpHandler
{
    ConnectCallback = async (context, cancellationToken) =>
    {
        var socket = new Socket(SocketType.Stream, ProtocolType.Tcp);
        try
        {
            await socket.ConnectAsync(new IPEndPoint(validIp, targetUrl.Port), cancellationToken);
            // 处理TLS握手，传入原主机名满足SNI要求
            var sslStream = new SslStream(new NetworkStream(socket, ownsSocket: true));
            await sslStream.AuthenticateAsClientAsync(targetUrl.Host, null, SslProtocols.Tls12 | SslProtocols.Tls13, true);
            return new NetworkStream(sslStream, ownsStream: true);
        }
        catch
        {
            socket.Dispose();
            throw;
        }
    }
};

using var client = new HttpClient(handler);
var response = await client.GetAsync(targetUrl);

问题2：如何捕获HttpClient的DNS查询结果并控制连接？ #

不需要完全基于TcpClient和SslStream重写HTTP逻辑，利用SocketsHttpHandler的扩展点即可实现：

方式1：自定义DnsResolver捕获并验证DNS结果 #

.NET 5及以上（包括.NET 8）允许通过SocketsHttpHandler.DnsResolver自定义DNS解析逻辑，这样你可以在解析时直接验证IP，通过后才会建立连接，从根源上避免DNS查询不一致的问题：

public class ValidatingDnsResolver : IDnsResolver
{
    private readonly IDnsResolver _innerResolver = new DnsResolver();
    private readonly List<IPAddressRange> _allowedRanges;

    public ValidatingDnsResolver(List<IPAddressRange> allowedRanges)
    {
        _allowedRanges = allowedRanges;
    }

    public async ValueTask<DnsEndPoint> ResolveAsync(DnsEndPoint endPoint, CancellationToken cancellationToken)
    {
        // 调用内置解析器获取IP
        var resolvedEndPoint = await _innerResolver.ResolveAsync(endPoint, cancellationToken);
        var ip = ((IPEndPoint)resolvedEndPoint).Address;
        
        // 验证IP是否在安全范围内
        if (!_allowedRanges.Any(range => range.Contains(ip)))
        {
            throw new InvalidOperationException("解析得到的IP不在安全范围内");
        }
        
        return resolvedEndPoint;
    }
}

// 使用自定义解析器
var handler = new SocketsHttpHandler
{
    DnsResolver = new ValidatingDnsResolver(allowedIpRanges)
};
using var client = new HttpClient(handler);
var response = await client.GetAsync(targetUrl);

方式2：通过ConnectCallback在连接前验证IP #

如果需要在连接建立前最后一刻确认并验证IP，可以在ConnectCallback中手动解析DNS、验证后再建立连接：

var handler = new SocketsHttpHandler
{
    ConnectCallback = async (context, cancellationToken) =>
    {
        // 手动解析目标域名的IP
        var hostEntry = await Dns.GetHostEntryAsync(context.DnsEndPoint.Host, cancellationToken);
        var validIp = hostEntry.AddressList.First(ip => allowedIpRanges.Any(range => range.Contains(ip)));
        if (validIp == null)
        {
            throw new InvalidOperationException("目标IP不在安全范围内");
        }
        
        // 连接到验证后的IP，并处理TLS SNI
        var socket = new Socket(SocketType.Stream, ProtocolType.Tcp);
        try
        {
            await socket.ConnectAsync(new IPEndPoint(validIp, context.DnsEndPoint.Port), cancellationToken);
            var sslStream = new SslStream(new NetworkStream(socket, ownsSocket: true));
            await sslStream.AuthenticateAsClientAsync(context.DnsEndPoint.Host, null, SslProtocols.Tls12 | SslProtocols.Tls13, true);
            return new NetworkStream(sslStream, ownsStream: true);
        }
        catch
        {
            socket.Dispose();
            throw;
        }
    }
};

补充：解决IP直连的TLS-SNI问题 #

直接用IP替换主机名导致TLS失败的核心原因是SNI需要原主机名来匹配服务器证书。上述两种方案都通过在SslStream.AuthenticateAsClientAsync中传入原主机名解决了这个问题，同时HttpClient会自动基于原URL携带正确的Host请求头，无需额外配置。

内容的提问来源于stack exchange，提问作者billpg